@volter/supercode-orchestrator 0.4.160 → 0.5.1

package/board/dispatch.mjs

@@ -15,7 +15,14 @@
 // Every side effect follows a committed transition: a card is claimed before its session is launched, and a
 // subscriber's cursor moves only after its notice was delivered, so two dispatchers over one board never both
 // launch and a crash between the two steps is answered by the next tick.
+import { monitorsRuns, failedObservation, surfaceIncident, auditEndedRuns } from './incidents.mjs';
+import { readEventFleet } from './event-fleet.mjs';
+let eventFleetRoot = null;
 import { inspectCompletionEvidence, noCodeChange, openReviewPullRequests, reviewDue, withCompletionEvidence, reviewCandidate, workflowRevision, retainWorkflowTick } from './ci.mjs';
+import { runtimeDoor } from './runtime-door.mjs';
+import { agentDoor, agentScope, teamsUnavailable, ensureCardAgent, localCardAgent, localAgentSessions, synchronizeLocalAgents, runBudgetRefusal, runsAwaitingUsage, recordRunUsage, agentPreamble, agentEnvironment, recordAgentRun, pendingAgentRuns, synchronizeAgentRun,agentProfileMismatch,activeAgentAssignments,finishAgentAssignment,synchronizeAgentEnds } from '../agents.mjs';
+import { materializeAgentHome } from '../agent-home.mjs';
+import { memorySnapshotSync } from '../hermes-cli.mjs';
 import { createRequire } from 'node:module';
 import { spawn as spawnChild, spawnSync } from 'node:child_process';
 import { closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
@@ -24,7 +31,7 @@ import { basename, dirname, join } from 'node:path';
 import { createHash, randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { view, boardCopyOf, boardPath, claimer, copyRefusal, event, json, listBoards, logsDir, now, openBoard, setActor, tx } from './store.mjs';
-import { doors, fire, loadWorkflow, resumeOf, runSpec, runWorkingSeconds, requestSessionClose, retireSupersededRuns, refreshCardInputs, refreshRelationAnswers, transitionsFor, scopeOf, statusOf, storedStatus, templateValue, workflowFor } from './workflow.mjs';
+import { doors, fire, loadWorkflow, resumeOf, runSpec, runWorkingSeconds, requestSessionClose, retireSupersededRuns, refreshCardInputs, refreshRelationAnswers, transitionsFor, scopeOf, statusOf, projectStatus, storedStatus, templateValue, workflowFor } from './workflow.mjs';
 import { checkWorkspace, assertWorkspaceOwner, notePresence, resolveWorkspace } from './workspace.mjs';
 import { capacity, harnessDefaults, holdings } from './capacity.mjs';
 import { evaluate, holds, render } from './expr.mjs';
@@ -46,34 +53,26 @@ export function normalMachine(name) {
 }
 
 /** This machine's name as supercode's addresses spell it: its Teams enrollment, else its host name. */
+let localMachineName;
 export function localMachine() {
-  const home = process.env.SUPERCODE_TEAMS_HOME || join(process.env.SUPERCODE_HOME || (process.env.XDG_CONFIG_HOME ? join(process.env.XDG_CONFIG_HOME, 'supercode') : join(process.env.HOME ?? '', '.config', 'supercode')), 'teams');
+  if (localMachineName) return localMachineName;
   try {
-    const contexts = JSON.parse(readFileSync(join(home, 'workspaces', 'contexts.json'), 'utf8'));
-    const ctx = contexts.contexts?.[contexts.current];
-    const enrollment = JSON.parse(readFileSync(join(home, 'workspaces', 'connectors', ctx.server_id, ctx.team_id, 'enrollment.json'), 'utf8'));
-    if (enrollment?.machine?.name) return normalMachine(enrollment.machine.name);
-  } catch { /* not enrolled: the host name */ }
-  return normalMachine(hostname());
+    const reply=runtimeDoor(null,'harness.v1.machine.describe',{}, {timeout:15_000});
+    if(reply.code===0){const machine=JSON.parse(reply.stdout);return localMachineName=normalMachine(machine.name??machine.hostname);}
+  } catch { /* no local daemon: a plain host still has its OS machine name */ }
+  return localMachineName=normalMachine(hostname());
 }
 
 /** The supercode command the dispatcher drives. */
 export const supercodeBin = () => process.env.SUPERCODE_BIN || 'supercode';
 
-// Installed board workers use their sibling Teams package, not a CLI build's retained checkout.
-// An explicit operator override remains authoritative for source development.
-let teamsEntry;
+/** Public CLI calls carry caller attribution; installed clients own transport selection. */
 export function commandEnv(as = null) {
-  if (teamsEntry === undefined) {
-    try { teamsEntry = createRequire(import.meta.url).resolve('@volter/supercode-teams/bin'); }
-    catch { teamsEntry = null; }
-  }
-  return { ...process.env, ...(!process.env.SUPERCODE_TEAMS_ENTRY && teamsEntry ? { SUPERCODE_TEAMS_ENTRY: teamsEntry } : {}),
-    ...(as ? { SUPERCODE_CALLER: as } : {}) };
+  return { ...process.env, ...(as ? { SUPERCODE_CALLER: as } : {}) };
 }
 
 function sc(args, { input = null, timeout = 120_000, as = null } = {}) {
-  // a neutral directory: `supercode teams …` resolves its entry from a checkout at the cwd. `as`: the board this
+  // `as`: the board this
   // command acts for, so a card's pane is started and closed by its board, whichever session ran the board's verb
   const env = commandEnv(as);
   const r = spawnSync(supercodeBin(), args, { cwd: tmpdir(), input: input ?? undefined, encoding: 'utf8', timeout, env, maxBuffer: 512 * 1024 * 1024 });
@@ -116,19 +115,11 @@ export function callerSession() {
   return claude;
 }
 
-export function observeFleet() {
-  const list = sc(['message', 'list', '--json']);
-  const sessions = list.code === 0 ? json(list.stdout.trim(), null) : null;
-  if (!Array.isArray(sessions)) return { ok: false, alive: new Set(), online: new Set(), error: `message list: ${(list.stderr || list.stdout).trim().slice(-300)}` };
-  const machines = sc(['teams', 'machines', 'events', '--json']);
-  const presence = machines.code === 0 ? lastJson(machines.stdout) : null;
-  const online = new Set([localMachine()]);
-  for (const m of presence?.items ?? []) if (m.linked) online.add(normalMachine(m.name));
-  presenceReading = { known: presence?.connected === true, online };
+export function observeFleet(root = eventFleetRoot) {
+  const fleet = readEventFleet(root);
+  presenceReading = { known: fleet.presenceKnown === true, online: new Set([localMachine(), ...fleet.online]) };
   notePresence(presenceReading);
-  return { ok: true, sessions, alive: new Set(sessions.map((s) => s.address).filter(Boolean)), online,
-    presenceKnown: presence?.connected === true, machineEvents: presence,
-    error: presence?.connected ? null : 'machine event stream unavailable; retaining existing runs until availability is known' };
+  return fleet;
 }
 
 // how the launcher opens each harness a pane lane can run, and how it names the session: Claude Code is told the id
@@ -142,7 +133,23 @@ const HARNESSES = {
 const addressOf = (s) => s?.address ?? (s?.session_id && s.machine ? `sc:${s.machine}:${s.harness ?? 'claude-code'}:${s.session_id}` : null);
 const pause = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 
-const sessionAlive = (fleet, session) => fleet.native?.has(addressOf(session)) ? fleet.native.get(addressOf(session)).alive : Boolean(session?.session_id) && fleet.alive.has(addressOf(session));
+// A run Teams never published (one outside a synced root, a scratch workspace's) is read on its own machine: a
+// headless worker by its pid, a pane by that machine's pane list. Null only when the machine cannot answer.
+const sessionAlive = (fleet, session) => fleet.native?.has(addressOf(session)) ? fleet.native.get(addressOf(session)).alive : unpublishedAlive(session);
+const paneLists = new Map();
+function unpublishedAlive(session) {
+  if (!session) return null;
+  if (session.surface === 'headless' && session.pid) return pidAlive(session.pid);
+  if (!session.pane || !session.machine) return null;
+  let entry = paneLists.get(session.machine);
+  if (!entry || Date.now() - entry.at > 5000) {
+    const r = doorOn(session.machine, 'harness.v1.panes.list', {}, { timeout: 60_000 });
+    const panes = r.code === 0 ? json(r.stdout.trim(), null) : null;
+    entry = { at: Date.now(), panes: Array.isArray(panes) ? panes : null };
+    paneLists.set(session.machine, entry);
+  }
+  return entry.panes ? entry.panes.some((p) => p.pane === session.pane && !p.dead) : null;
+}
 
 /** Native activity comes from the machine's harness discovery, not catalogue age. */
 function nativeSessions(machine, harness) {
@@ -224,7 +231,6 @@ export function lanesOf(profiles = {}) {
   return out;
 }
 
-const onMachine = machine => normalMachine(machine ?? localMachine()) === localMachine() ? [] : ['--machine', machine];
 // The latest presence reading (observeFleet). A machine it reads as offline is not asked: each remote call would
 // wait out its timeout, and one offline machine held every close and launch on this one.
 let presenceReading = null;
@@ -232,45 +238,24 @@ const offlineMachine = (machine) => {
   const m = normalMachine(machine ?? localMachine());
   return m !== localMachine() && presenceReading?.known === true && !presenceReading.online.has(m);
 };
-/** `supercode <args>` for `machine`: on another machine through its Teams server, answered at once when it is offline. */
-const scOn = (machine, args, options) => offlineMachine(machine)
+/** A machine's public door (`harness.v1.*`), answered at once when the machine reads as offline. */
+const doorOn = (machine, method, params, options) => offlineMachine(machine)
   ? { code: 1, stdout: '', stderr: `machine ${normalMachine(machine)} is offline` }
-  : sc([...args, ...onMachine(machine)], options);
+  : runtimeDoor(normalMachine(machine ?? localMachine()) === localMachine() ? null : machine, method, params, options);
 const unavailable = message => Object.assign(new Error(message), { launchDeferred: true });
 
 // ------------------------------------------------------------------ supervise
 
 function supervise(board, fleet, settings, report, entry, effects) {
   const rows = board.db.prepare(entry.workflow.run ? "SELECT id FROM tasks WHERE current_run_id IS NOT NULL" : "SELECT id FROM tasks WHERE status = 'running'").all();
-  // The catalog can lag a pane. Read the actual machines once, before any board mutation.
-  const observed = new Map();
+  // Published native observations are the only liveness input. Missing data remains unknown. A launch the
+  // observations show stopped is asked, through its machine's door, how it ended.
   const exits = new Map();
-  const native = new Map(); fleet.native = new Map();
   for (const { id } of rows) {
     const session = currentRun(board.db, id)?.metadata?.supercode;
-    if (!session?.session_id || session.pane || session.surface === 'headless') continue;
-    const key = `${session.machine}:${session.harness}`;
-    if (!native.has(key)) {
-      try { native.set(key, nativeSessions(session.machine, session.harness)); }
-      catch (error) { native.set(key, null); report.failed.push([id, error.message]); }
-    }
-    fleet.native.set(addressOf(session), native.get(key) ? nativeReading(native.get(key), session) : { alive: null });
-  }
-  for (const { id } of rows) {
-    const s = currentRun(board.db, id)?.metadata?.supercode;
-    if (!s?.pane || observed.has(s.machine)) continue;
-    const r = scOn(s.machine, ['teams', 'panes', 'ls'], { timeout: 60_000 });
-    const list = r.code === 0 ? json(r.stdout.trim(), null) : null;
-    observed.set(s.machine, Array.isArray(list) ? new Set(list.filter(p => !p.dead).map((p) => p.pane)) : null);
-    if (!Array.isArray(list)) report.failed.push([id, `pane liveness unavailable; retaining run: ${(r.stderr || r.stdout).trim().slice(-200)}`]);
-  }
-  for (const {id} of rows) {
-    const session=currentRun(board.db,id)?.metadata?.supercode;
-    const panes=observed.get(session?.machine);
-    if(session?.launch_key && panes instanceof Set && !panes.has(session.pane)) {
-      try { const receipt=launchReceipt(board,session);if(receipt?.live===false&&receipt.exit)exits.set(id,receipt.exit); }
-      catch(error){report.failed.push([id,`exit receipt unavailable; retaining liveness observation: ${error.message}`]);}
-    }
+    if (!session?.launch_key || !fleet.ok || sessionAlive(fleet, session) !== false) continue;
+    try { const receipt = launchReceipt(board, session); if (receipt?.live === false && receipt.exit) exits.set(id, receipt.exit); }
+    catch (error) { report.failed.push([id, `exit receipt unavailable; retaining liveness observation: ${error.message}`]); }
   }
   for (const { id } of rows) {
     tx(board, (db) => {
@@ -278,20 +263,20 @@ function supervise(board, fleet, settings, report, entry, effects) {
       if (!task || (entry.workflow.run ? !task.current_run_id : task.status !== 'running')) return;
       const runRow = currentRun(db, id);
       let session = runRow?.metadata?.supercode ?? null;
-      if (session?.pane) {
-        let found;
-        try { found = continuationPane(fleet, session, observed.get(session.machine)); }
-        catch (error) { report.failed.push([id, error.message]); return; }
-        if (found && found !== session.pane) {
-          session = { ...session, pane: found, seen_at: now(), missing_since: null, close_requested: null, closed_at: null, close_confirmed_at: null, close_error: null };
-          setRunSession(db, runRow.id, session);
-          event(db, id, 'session_rebound', { session_id: session.session_id, pane: found }, runRow.id);
-        }
+      const liveBinding=fleet.sessions?.find(item=>item.address===addressOf(session)&&item.state==='running'&&item.pane);
+      if(liveBinding?.pane&&liveBinding.pane!==session.pane){
+        session={...session,pane:liveBinding.pane,missing_since:null};setRunSession(db,runRow.id,session);
+        event(db,id,'session_rebound',{session_id:session.session_id,pane:session.pane},runRow.id);
       }
       const t = now();
       // what the dispatcher saw becomes a platform event; the card's workflow says what it does
       const observe = (name, payload, bucket) => {
         try {
+          if (monitorsRuns(entry) && failedObservation(name)) {
+            surfaceIncident(db, board, entry, id, name, payload);
+            if (bucket) report[bucket].push(id);
+            return;
+          }
           const r = fire(db, board, entry, id, name, { roles: ['platform'], payload });
           effects.push(...r.effects);
           if (bucket) report[bucket].push(id);
@@ -319,8 +304,7 @@ function supervise(board, fleet, settings, report, entry, effects) {
       // Availability is the same retained linked/unlinked feed subscribers hear.
       // A failed stream is unknown, not evidence that every remote machine left.
       if (session?.session_id && session.surface !== 'headless') {
-        const panes = session.pane ? observed.get(session.machine) : null;
-        const reachable = panes instanceof Set || fleet.online.has(session.machine);
+        const reachable = fleet.online.has(session.machine);
         if (!reachable && !fleet.presenceKnown) return;
         if (!reachable) {
           const next = {...session, offline_since: session.offline_since ?? t};
@@ -341,8 +325,7 @@ function supervise(board, fleet, settings, report, entry, effects) {
         }
       }
       // Hermes's orphan reconciliation: a running card whose claim bookkeeping is broken, with nothing live behind it
-      const paneReading = session?.pane ? observed.get(session.machine) : undefined;
-      const paneLive = paneReading instanceof Set ? paneReading.has(session.pane) : null;
+      const paneLive = session?.session_id ? sessionAlive(fleet,session) : null;
       const live = session?.surface === 'headless' ? pidAlive(session.pid) : session?.pane ? paneLive !== false : session?.session_id ? (fleet.ok ? sessionAlive(fleet, session) !== false : true) : false;
       // (whether it is reconciled is the workflow's: its `orphaned` transitions and their guard)
       if ((!task.claim_lock || !task.claim_expires) && !live) {
@@ -378,6 +361,7 @@ function supervise(board, fleet, settings, report, entry, effects) {
           // follows, and it is not a crash to restart
           const ended = { code: exit.failed ? 1 : 0, error: `native session ${session.session_id} ended: ${exit.how}`, session_id: session.session_id, pane: session.pane };
           if (!exit.failed) {
+            if (monitorsRuns(entry)) { observe('session_closed', {...ended,exit},'crashed'); return; }
             try {
               const r = fire(db, board, entry, id, 'session_closed', { roles: ['platform'], payload: ended });
               effects.push(...r.effects); (report.closed_by_hand ??= []).push(id);
@@ -387,11 +371,10 @@ function supervise(board, fleet, settings, report, entry, effects) {
           observe('exited', ended, 'crashed');
           return;
         }
-        if (session.pane && paneLive === null) return; // no machine reading, no loss verdict
-        if (!session.pane && !fleet.ok) return;
-        const alive = session.pane ? paneLive : sessionAlive(fleet, session);
-        if (alive == null) return; // native discovery was inconclusive
-        const machineUp = paneReading instanceof Set || fleet.online.has(session.machine);
+        if (!fleet.ok) return;
+        const alive = sessionAlive(fleet,session);
+        if (alive == null) return;
+        const machineUp = fleet.online.has(session.machine);
         const young = t - Number(session.launched_at ?? 0) < Number(limits.grace ?? settings.grace);
         const missing = !alive && machineUp && !young;
         const next = { ...session };
@@ -450,7 +433,7 @@ function stopSession(board, session) {
     return;
   }
   if (session.pane) {
-    const r = sc(['teams', 'panes', 'close', session.pane, ...(session.machine ? ['--machine', session.machine] : [])], { timeout: 60_000, as: boardAddress(board.label) });
+    const r = runtimeDoor(normalMachine(session.machine??localMachine())===localMachine()?null:session.machine,'harness.v1.panes.close',{pane:session.pane},{env:commandEnv(),timeout:60_000,as:boardAddress(board.label)});
     if (r.code !== 0 || json(r.stdout.trim(), null)?.closed !== session.pane) throw new Error(`closing pane ${session.pane}: ${(r.stderr || r.stdout || `exit ${r.code}`).trim().slice(-500)}`);
   }
 }
@@ -537,6 +520,7 @@ function startCards(board, fleet, lanes, settings, report, entry, effects, { onl
   const stop = paused(board.root);
   if (stop) { report.paused = stop; return; }
   const { workflow, params } = entry;
+  if (!dry) tx(board, db => auditEndedRuns(db, board, entry));
   const d = workflow.dispatch;
   const pressure = memoryPressure();
   const tickState = { local_started: 0 };
@@ -633,7 +617,7 @@ function startCards(board, fleet, lanes, settings, report, entry, effects, { onl
     } catch (error) {
       if (error.launchPending) { report.queued.push([task.id, error.message]); continue; }
       const payload = { error: String(error.message).slice(-500), ...(error.resumeFailed ? { resume_failed: true, ...error.resumeFailed } : {}) };
-      try { const r = tx(board, (db) => fire(db, board, entry, task.id, 'spawn_failed', { roles: ['platform'], payload })); effects.push(...r.effects); } catch { /* no transition for it */ }
+      try { const r = tx(board, db => monitorsRuns(entry) ? (surfaceIncident(db,board,entry,task.id,'spawn_failed',payload), {effects:[]}) : fire(db, board, entry, task.id, 'spawn_failed', { roles: ['platform'], payload })); effects.push(...r.effects); } catch { /* no transition for it */ }
       report.failed.push([task.id, String(error.message).slice(-300)]);
     }
   }
@@ -656,7 +640,7 @@ export function launchRun(board, entry, id, lane, fleet, settings) {
   const where = whereOf(board, task);
   // a subtask's run also sees its arc: the arc's text, tasks and thread (where its owner's rulings are)
   const arcContext = task.subtask_of ? view(board, (db) => cardContext(db, task.subtask_of)) : '';
-  const prompt = render(spec.prompt, { ...scope, where, context: view(board, (db) => cardContext(db, id)), arc_context: arcContext, doors: doors(entry.workflow, status, spec.role, id, where, surface) });
+  let prompt = render(spec.prompt, { ...scope, where, context: view(board, (db) => cardContext(db, id)), arc_context: arcContext, doors: doors(entry.workflow, status, spec.role, id, where, surface) });
   // the run's session record knows its status, role and slot (a reviewer's slot is never the implementer's); the slot
   // is a template, so a step can ask for isolation by naming a new one
   const slot = String(templateValue(spec.session ?? 'worker', scope) ?? 'worker');
@@ -668,12 +652,57 @@ export function launchRun(board, entry, id, lane, fleet, settings) {
   // the model it runs is recorded with the session, for caps that count by model
   const meta = { status, role: spec.role, slot, model: task.model_override ?? lane.model ?? null, ...(spec.role === 'reviewer' ? { review_candidate: reviewCandidate(board, id) } : {}) };
   try {
+    const context=process.env.SUPERCODE_CONTEXT,team=agentScope(context),machine=normalMachine(task.machine)===localMachine()?null:task.machine;
+    const cardOptions={root:board.root,org:team.org,server:team.server,profiles:entry.profiles,
+      profile:lane.name,card:id,role:spec.role??slot,sponsor:task.sponsor??null,machine,context};
+    // Situation 16: with no reachable Teams the card's agent is its locally minted identity, declared later under the same id.
+    let agent=null,previous=null,reader=null;
+    if(!team.offline){
+      try{
+        agent=ensureCardAgent(cardOptions);
+        previous=agentDoor('sessions',[agent.identity.id,{limit:200}],{context}).items??[];
+        reader=agentDoor('readerContext',[agent.identity.id,machine],{context,timeout:60000});
+      }catch(error){if(!teamsUnavailable(error))throw error;tx(board,db=>event(db,id,'agent_identity_local',{reason:error.message},runId));}
+    }
+    agent??=localCardAgent(cardOptions);
+    // G3: a run of an agent over its budget does not start; the reason waits on the card until the window passes
+    const budgets=[...(entry.profiles?.default?.budgets??[]),...(lane.name!=='default'?entry.profiles?.[lane.name]?.budgets??[]:[])];
+    const refused=budgets.length?runBudgetRefusal(board.root,agent.identity.id,budgets,new Date().toISOString()):null;
+    if(refused)throw Object.assign(new Error(`not started, over budget: ${refused}`),{launchDeferred:true});
+    previous??=localAgentSessions(board.root,team.org,agent.identity.id);
+    prompt=`${agentPreamble(agent,{previous:previous.map(item=>({session:item.session,machine:item.machine,ended_at:item.ended_at,end_reason:item.end_reason}))})}\n\n${prompt}`;
+    Object.assign(meta,{agent_id:agent.identity.id,agent_org:team.org,agent_context:context??null,
+      agent_profile_intent:structuredClone(agent.intended.resolved),
+      agent_env:agentEnvironment(agent,{root:board.root,context:reader?.context})});
+    // The agent's own memory reaches every session of it: headless runs open its home; a pane, which may sit on
+    // another machine, gets the home's snapshot in its first prompt. A shared profile's memory is never used.
+    const agentHome=materializeAgentHome(board.root,team.org,agent.identity.id,lane);
+    if(surface==='headless')meta.agent_env.HERMES_HOME=agentHome;
+    else{const memory=memorySnapshotSync(agentHome);if(memory)prompt=`${prompt}\n\n${memory}`;}
     const result = surface === 'pane'
       ? launchPane(board, task, runId, lane, fleet, { input: prompt, slot, meta })
       : launchHeadless(board, task, runId, lane, settings, { prompt, skills: spec.skills ?? [], meta });
-    tx(board,db=>setRunSession(db,runId,{launch_deferred:false,launch_deferred_error:null}));
+    tx(board,db=>{
+      setRunSession(db,runId,{launch_deferred:false,launch_deferred_error:null,restart_authorized:false});
+      event(db,id,'restart_authorization_consumed',{},runId);
+    });
+    if(result?.session_id){
+      const ref=`${result.harness}:${result.session_id}`;
+      recordAgentRun(board.root,team.org,agent.identity.id,{session:ref,machine:result.machine,run:runId});
+      if(agent.synced!==false){
+        try{synchronizeAgentRun(board.root,team.org,{agent_id:agent.identity.id,session_ref:ref,machine:result.machine},{context,intended:meta.agent_profile_intent});}
+        catch(error){tx(board,db=>event(db,id,'agent_session_sync_pending',{session:ref,agent:agent.identity.id,error:error.message},runId));}
+      }
+    }
     return result;
   } catch(error) {
+    // An issued asynchronous launch may bind later. Its original permission
+    // still belongs to this attempt, never a future lost-session restart. A
+    // deferred launch was never issued: its run keeps the permission for its retry.
+    if(!error.launchDeferred)tx(board,db=>{
+      setRunSession(db,runId,{restart_authorized:false});
+      event(db,id,'restart_authorization_consumed',{},runId);
+    });
     if(error.launchDeferred) {
       tx(board,db=>{
         const previous=currentRun(db,id)?.metadata?.supercode;
@@ -688,22 +717,33 @@ export function launchRun(board, entry, id, lane, fleet, settings) {
 
 /** Start one card now by a person's word (a triage card's session, a manager's start): the workflow's start event. */
 export async function startCard(board, id, { roles = ['manager'], lanes, settings } = {}) {
+  // the board's own published fleet projection, as a tick reads it: a manager's or creator's start that continues the
+  // slot's session checks that session through it
+  eventFleetRoot = board.root;
   const entry = await loadWorkflow(board.root);
   const fleet = observeFleet();
   const before = getTaskNow(board, id), checked = checkWorkspace(board, before);
   const moved = tx(board, (db) => {
     assertWorkspaceOwner(db, before, checked);
     if (checked) db.prepare('UPDATE supercode_cards SET workspace_root=? WHERE task_id=?').run(checked.mainRoot, id);
-    if (!roles.includes('manager')) throw new Error('Only the manager starts a held card; request its decision.');
+    if (!roles.some(role => ['manager', 'creator'].includes(role))) throw new Error('Only the manager or creator starts a held card; request its decision.');
     event(db, id, 'dispatch_released', { reason: 'explicit start' });
-    return fire(db, board, entry, id, entry.workflow.dispatch.start, { roles, payload: { lock: claimer() } });
+    requestSessionClose(db,id);
+    const moved = fire(db, board, entry, id, entry.workflow.dispatch.start, { roles, payload: { lock: claimer() } });
+    setRunSession(db, getTask(db,id).current_run_id, { restart_authorized: true });
+    return moved;
   });
   const task = getTaskNow(board, id);
   const spec = runSpec(entry, moved.to, task);
   const profile = spec ? view(board, (db) => evaluate(entry.workflow.roles?.[spec.role] ?? 'card.assignee', scopeOf(db, board, task, { params: entry.params }))) : null;
   const lane = profile ? lanes[profile] : null;
   if (spec && !lane) throw new Error(`${id} is ${moved.to}, run by ${spec.role} (${profile ?? 'nobody'}), which is no lane of this home`);
-  return lane ? launchRun(board, entry, id, lane, fleet, settings) : null;
+  if (!lane) return null;
+  try { return launchRun(board,entry,id,lane,fleet,settings); }
+  catch (error) {
+    if (monitorsRuns(entry) && !error.launchPending) tx(board,db=>surfaceIncident(db,board,entry,id,'spawn_failed',{error:error.message}));
+    throw error;
+  }
 }
 
 /** Reconcile durable close intent and ended runs, including old unverified closed_at records.
@@ -740,7 +780,9 @@ export function closeRequested(board, report, { taskId = null, caller = null } =
         (report.closed ??= []).push({ task_id: row.task_id, ...session, receipt });
         continue;
       }
-      if (receipt?.pane && receipt.status !== 'issued' && (receipt.status || receipt.live || receipt.exit)) { bindLaunch(board, row, session, receipt.pane, session.session_id); session = { ...session, pane: receipt.pane }; }
+      // A receipt that names its pane and reads it not live is terminal enough to settle, with or without a status (a
+      // daemon that predates launch statuses answers none): the board's own pane reading below confirms the close
+      if (receipt?.pane && receipt.status !== 'issued' && (receipt.status || typeof receipt.live === 'boolean' || receipt.exit)) { bindLaunch(board, row, session, receipt.pane, session.session_id); session = { ...session, pane: receipt.pane }; }
       else {
         const error = `close deferred: ${receiptError ?? `awaiting terminal launch receipt ${session.launch_key} (${receipt?.status ?? 'unknown'})`}`;
         tx(board, (db) => {
@@ -751,6 +793,7 @@ export function closeRequested(board, report, { taskId = null, caller = null } =
         continue;
       }
     }
+    if (session?.monitor_held && !session.close_requested) continue; // only an explicit close action ends this process
     if ((!session?.pane && session?.surface !== 'native') || session.close_transferred_to || session.close_confirmed_at || (!row.ended_at && !session.close_requested)) continue;
     if (caller && session.session_id === caller) continue; // let the command that ended its own run return
     const active = view(board, (db) => db.prepare(`SELECT r.id, r.metadata FROM task_runs r WHERE r.ended_at IS NULL OR EXISTS (SELECT 1 FROM tasks t WHERE t.current_run_id = r.id)`).all());
@@ -769,7 +812,7 @@ export function closeRequested(board, report, { taskId = null, caller = null } =
         }
       } else {
       if (!panes.has(machine)) {
-        const r = scOn(machine, ['teams', 'panes', 'ls'], { timeout: 60_000, as: boardAddress(board.label) });
+        const r = doorOn(machine, 'harness.v1.panes.list',{}, { timeout: 60_000, as: boardAddress(board.label) });
         const list = r.code === 0 ? json(r.stdout.trim(), null) : null;
         panes.set(machine, Array.isArray(list) ? { live: new Set(list.filter(p => !p.dead).map((p) => p.pane)) } : { error: `cannot read panes on ${machine}: ${(r.stderr || r.stdout).trim().slice(-300)}` });
       }
@@ -829,6 +872,9 @@ function observeIdle(board, fleet, settings, report, entry, effects) {
         threshold_seconds: settings.idleQuiet, turns_before: Number(session.goal_turns ?? 0),
       };
       const retain = (decision, extra = {}) => {
+        // A reading that decides nothing is kept once per state: rewriting it each pass would wake the next pass.
+        const prior = session.idle_observation;
+        if (!['dispatched', 'dispatch_failed'].includes(decision) && prior?.decision === decision && prior.last_message_at_ms === reading.last_message_at_ms && prior.status === reading.status) return prior;
         const observation = { ...reading, decision, turns_after: reading.turns_before, ...extra };
         const patch = { idle_observation: observation };
         if (decision === 'below_threshold') patch.idle_below_threshold = observation;
@@ -996,9 +1042,9 @@ const getTaskNow = (board, id) => view(board, (db) => getTask(db, id));
 
 /** A transport error is not a negative launch receipt. The key remains owned by its run. */
 function launchReceipt(board, session) {
-  const r = scOn(session.machine, ['teams', 'launches', 'get', session.launch_key],
+  const r = doorOn(session.machine, 'harness.v1.launches.get',{key:session.launch_key},
     { timeout: 30_000, as: boardAddress(board.label) });
-  if (r.code !== 0) throw unavailable(`launch receipt unavailable on ${session.machine}: install the matching Teams CLI and machine capability (teams launches get): ${(r.stderr || r.stdout).trim().slice(-300)}`);
+  if (r.code !== 0) throw unavailable(`launch receipt unavailable on ${session.machine}: install the matching machine capability (harness.v1.launches.get): ${(r.stderr || r.stdout).trim().slice(-300)}`);
   if (r.stdout.trim() === 'null') return null;
   const receipt = lastJson(r.stdout);
   if (!receipt || receipt.key !== session.launch_key) throw unavailable(`invalid launch receipt for ${session.launch_key} on ${session.machine}`);
@@ -1006,7 +1052,7 @@ function launchReceipt(board, session) {
 }
 
 function cancelUnissuedLaunch(board, session) {
-  const result = scOn(session.machine, ['teams', 'launches', 'cancel', session.launch_key],
+  const result = doorOn(session.machine, 'harness.v1.launches.cancel', {key:session.launch_key},
     { timeout: 30_000, as: boardAddress(board.label) });
   if (result.code !== 0) throw unavailable(`launch cancellation unavailable on ${session.machine}; retain ${session.launch_key}: ${(result.stderr || result.stdout).trim().slice(-300)}`);
   const receipt = lastJson(result.stdout);
@@ -1034,7 +1080,8 @@ function retireUnissuedLaunch(board, row, session, receipt, { entry = null, effe
       forgotten: saved.mode === 'fresh' ? true : Boolean(saved.forgotten) });
     event(db, row.task_id, 'session_launch_cancelled', { key: session.launch_key, machine: session.machine, receipt }, row.id);
     if (!current.ended_at) {
-      const moved = fire(db, board, entry, row.task_id, 'spawn_failed', { roles: ['platform'], payload: { error: `launch ${session.launch_key} was not issued; its machine retired the key` } });
+      const payload = { error: `launch ${session.launch_key} was not issued; its machine retired the key` };
+      const moved = monitorsRuns(entry) ? (surfaceIncident(db,board,entry,row.task_id,'spawn_failed',payload), {effects:[]}) : fire(db,board,entry,row.task_id,'spawn_failed',{roles:['platform'],payload});
       collected.push(...moved.effects);
     }
     event(db, row.task_id, 'session_closed', { key: session.launch_key, machine: session.machine, reason: 'launch not issued', receipt }, row.id);
@@ -1065,6 +1112,7 @@ function bindLaunch(board, row, session, pane, sid) {
 
 /** A fast worker can reach its first board door before open's reply. Bind only the daemon's keyed pane. */
 export function reconcileCallerLaunch(board, sid) {
+  eventFleetRoot = board.root;
   if (view(board, (db) => db.prepare(`SELECT 1 FROM task_runs r JOIN tasks t ON t.current_run_id=r.id
     WHERE json_extract(r.metadata, '$.supercode.session_id')=? AND COALESCE(json_extract(r.metadata, '$.supercode.launch_pending'),0)=0`).get(sid))) return;
   const rows = view(board, (db) => db.prepare(`SELECT r.id, r.task_id, r.metadata FROM task_runs r
@@ -1089,7 +1137,63 @@ export function reconcileCallerLaunch(board, sid) {
 }
 
 function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes) {
+  // A delayed launch receipt/catalogue event binds the same declared agent, never another identity.
+  // A resumed session is held by its newest run; an earlier run of the same session no longer owns it.
+  const agentRuns=[...new Map(view(board,db=>db.prepare("SELECT id,task_id,metadata,ended_at FROM task_runs WHERE json_extract(metadata,'$.supercode.agent_id') IS NOT NULL ORDER BY id").all())
+    .map(row=>{const session=json(row.metadata,{})?.supercode;return [session?.session_id?addressOf(session):`run:${row.id}`,row];})).values()];
+  const orgs=new Map();
+  for(const row of agentRuns){
+    const session=json(row.metadata,{})?.supercode;
+    if(!session?.session_id||!session.agent_org)continue;
+    const observation=fleet.sessions?.find(item=>item.address===addressOf(session))?.identity;
+    if(observation?.agent?.id===session.agent_id&&session.agent_profile_revision!==observation.revision){
+      const mismatch=agentProfileMismatch(session.agent_profile_intent,observation.resolved);
+      tx(board,db=>{
+        // Rule 4: a run whose recorded profile differs from its agent's intent is shown and not counted.
+        setRunSession(db,row.id,{agent_profile_recorded:observation.resolved,agent_profile_revision:observation.revision,agent_profile_mismatch:mismatch,counted:!mismatch.differences.length});
+        event(db,row.task_id,mismatch.differences.length?'agent_profile_drift':'agent_profile_recorded',{agent:session.agent_id,session:session.session_id,comparison:mismatch},row.id);
+      });
+    }
+    recordAgentRun(board.root,session.agent_org,session.agent_id,{session:`${session.harness}:${session.session_id}`,machine:session.machine,run:row.id});
+    orgs.set(session.agent_org,session.agent_context);
+  }
+  // Identities minted while Teams was absent are declared under their ids before their sessions are joined.
+  const context=process.env.SUPERCODE_CONTEXT,scope=agentScope(context);
+  if(!scope.offline){
+    orgs.set(scope.org,orgs.get(scope.org)??context);
+    for(const pending of synchronizeLocalAgents({root:board.root,profiles:entry.profiles,context}))report.queued.push([pending.agent,`agent declaration pending: ${pending.error}`]);
+  }
+  orgs.delete('local');
+  // G3: an ended run's session usage, read once from its harness's own records on its machine
+  for(const org of new Set(agentRuns.map(row=>json(row.metadata,{})?.supercode?.agent_org).filter(Boolean))){
+    let read=0;
+    for(const row of runsAwaitingUsage(board.root,org)){
+      const run=agentRuns.find(item=>String(item.id)===String(row.run_id));
+      if(!run?.ended_at||read>=5)continue;
+      const [harness,...rest]=row.session_ref.split(':'),machine=row.machine&&normalMachine(row.machine)!==localMachine()?row.machine:null;
+      // the usage door loads the session by its whole locator, which discovery names
+      const sessionId=rest.join(':'),found=runtimeDoor(machine,'harness.v1.sessions.discover',{query:sessionId,harnesses:[harness],limit:200},{timeout:30_000});
+      const locator=found.code===0?json(found.stdout.trim(),{})?.sessions?.find(item=>item.locator?.harness===harness&&item.locator?.session_id===sessionId)?.locator:null;
+      const reply=locator?runtimeDoor(machine,'harness.v1.sessions.usage',{locator},{timeout:30_000}):{code:1};read++;
+      if(reply.code===0)recordRunUsage(board.root,org,row.session_ref,json(reply.stdout.trim(),{})?.usage??[]);
+      // a session unreadable a day after its run ended is recorded as having no usage record, so it stops retrying
+      else if(now()-Number(run.ended_at)>86400)recordRunUsage(board.root,org,row.session_ref,[]);
+    }
+  }
+  for(const assignment of activeAgentAssignments(board.root)){
+    if(assignment.kind!=='card')continue;
+    const task=getTaskNow(board,assignment.target);
+    if(task&&(task.archived||['done','cancelled'].includes(task.status)))finishAgentAssignment(board.root,assignment.org,assignment.id,`card ${assignment.target} ${task.archived?'archived':task.status}`);
+  }
+  for(const [org,context] of orgs)for(const pending of synchronizeAgentEnds(board.root,org,{context}))report.queued.push([pending.agent,`agent end synchronization pending: ${pending.error}`]);
+  for(const [org,context] of orgs)for(const row of pendingAgentRuns(board.root,org)){
+    const launch=agentRuns.find(run=>String(run.id)===String(row.run_id));
+    try{synchronizeAgentRun(board.root,org,row,{context,intended:json(launch?.metadata,{})?.supercode?.agent_profile_intent});}
+    catch(error){report.queued.push([row.run_id,`agent session sync pending: ${error.message}`]);}
+  }
   const deferred=view(board,db=>db.prepare("SELECT t.id,r.started_at FROM tasks t JOIN task_runs r ON r.id=t.current_run_id WHERE r.ended_at IS NULL AND json_extract(r.metadata,'$.supercode.launch_deferred')=1").all());
+  // A deferred launch was never issued (a reading or door was not yet available): it is the start its manager, creator
+  // or workflow asked for, carried out within the launch window; supervise surfaces it once when the window ends
   for(const {id,started_at} of deferred) {
     if (now() - started_at >= settings.launchWindow) continue;
     try {
@@ -1101,7 +1205,7 @@ function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes
       if(session)report.started.push([id,session.address??session.session_id,session.mode]);
     }catch(error){
       if(error.launchPending){report.queued.push([id,error.message]);continue;}
-      const moved=tx(board,db=>fire(db,board,entry,id,'spawn_failed',{roles:['platform'],payload:{error:error.message}}));effects.push(...moved.effects);
+      const moved=tx(board,db=>monitorsRuns(entry)?(surfaceIncident(db,board,entry,id,'spawn_failed',{error:error.message}),{effects:[]}):fire(db,board,entry,id,'spawn_failed',{roles:['platform'],payload:{error:error.message}}));effects.push(...moved.effects);
       report.failed.push([id,error.message]);
     }
   }
@@ -1130,7 +1234,9 @@ function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes
           const moved = tx(board, (db) => {
             if (getTask(db, row.task_id)?.current_run_id !== row.id) return null;
             setRunSession(db, row.id, { launch_pending: false });
-            return fire(db, board, entry, row.task_id, 'spawn_failed', { roles: ['platform'], payload: { error: `launch ${s.launch_key} ended before session binding` } });
+            const payload = { error: `launch ${s.launch_key} ended before session binding` };
+            if (monitorsRuns(entry)) { surfaceIncident(db, board, entry, row.task_id, 'spawn_failed', payload); return { effects: [] }; }
+            return fire(db, board, entry, row.task_id, 'spawn_failed', { roles: ['platform'], payload });
           });
           if (moved) effects.push(...moved.effects);
         }
@@ -1153,11 +1259,13 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
     task = { ...task, workspace_path: made };
   }
   const model = task.model_override ?? lane.model;
+  if(meta.agent_profile_intent)meta.agent_profile_intent.worker={...meta.agent_profile_intent.worker,harness:lane.harness,model:model??null,cwd:task.workspace_path};
   const tail = model ? ['--model', model] : [];
   if (lane.harness === 'codex' && lane.reasoning_effort) tail.push('-c', `model_reasoning_effort=${JSON.stringify(lane.reasoning_effort)}`);
   const harness = HARNESSES[lane.harness] ? lane.harness : 'claude-code';
   const how = HARNESSES[harness];
-  const base = ['open', '--new', how.program, '--detach', `--window=${window}`, '--on', task.machine, '--cwd', task.workspace_path];
+  const base = ['open', '--new', how.program, '--detach', `--window=${window}`, '--on', task.machine, '--cwd', task.workspace_path, '--env', 'SUPERCODE_BOARD_PROCESS_GUARD=1',
+    ...Object.entries(meta.agent_env??{}).flatMap(([key,value])=>['--env',`${key}=${value}`])];
   // the slot's last session: kept when live, resumed when lost, never another slot's (a reviewer's is its own)
   // a close its session's own command asked for is carried out first, so its pane is gone before the slot's next
   // session starts (never two processes on one session)
@@ -1171,7 +1279,7 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
   if (prev?.session_id && !prev.forgotten && (prev.harness ?? 'claude-code') === harness && prev.machine === machine) {
     const fresh = observeFleet();
     if (!fresh.ok) throw unavailable(`cannot check for a manual continuation of ${prev.session_id}: ${fresh.error}`);
-    const r = scOn(machine, ['teams', 'panes', 'ls'], { timeout: 60_000 });
+    const r = doorOn(machine, 'harness.v1.panes.list',{}, { timeout: 60_000 });
     const listed = r.code === 0 ? json(r.stdout.trim(), null) : null;
     if (!Array.isArray(listed)) throw unavailable(`cannot read panes before continuing ${prev.session_id}: ${(r.stderr || r.stdout).trim().slice(-300)}`);
     const pane = continuationPane(fresh, prev, new Set(listed.filter(p => !p.dead).map((p) => p.pane)));
@@ -1186,6 +1294,9 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
     if (prev?.close_requested && !prev.closed_at) throw unavailable(`the slot's session ${prev.session_id} asked to be closed and its pane ${prev.pane} could not be: ${report.undelivered.map((u) => u[2]).join('; ') || 'no reason given'}`);
   }
   const openOwned = (key, sid, mode, args) => {
+    const description = doorOn(machine,'harness.v1.machine.describe',{});
+    const policy = description.code === 0 ? json(description.stdout,null)?.boardProcessPolicy : null;
+    if (policy?.version !== 1 || !policy.harnesses?.includes(harness)) throw unavailable(`machine ${machine} has no native board process guard for ${harness}; no unguarded session was launched`);
     launchReceipt(board, { machine, launch_key: key }); // Prove the exact receipt door before starting a process.
     tx(board, (db) => setRunSession(db, runId, { ...meta, surface: 'pane', machine, harness, slot,
       session_id: sid, mode, launch_key: key, launch_pending: true, launched_at: now() }));
@@ -1236,7 +1347,7 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
     if (paneLive && (prev.closed_at || prev.close_requested || prev.forgotten)) throw new Error(`session ${prev.session_id} still has live pane ${prev.pane}; cannot resume or replace it`);
     if (!prev.closed_at && !prev.close_requested && (prev.pane ? paneLive : sessionAlive(fleet, prev))) {
       // the session is kept; the heartbeat's count belongs to the run that ended, so the new run starts it again
-      const { missing_since: _m, goal_turns: _t, goal_nudged_at: _n, idle_observation: _io, idle_below_threshold: _ib, idle_eligible: _ie, close_requested: _q, closed_at: _c, close_confirmed_at: _cc, close_error: _ce, close_attempts: _ca, close_attempted_at: _ct, ...kept } = prev;
+      const { missing_since: _m, goal_turns: _t, goal_nudged_at: _n, idle_observation: _io, idle_below_threshold: _ib, idle_eligible: _ie, close_requested: _q, closed_at: _c, close_confirmed_at: _cc, close_error: _ce, close_attempts: _ca, close_attempted_at: _ct, monitor_held: _mh, ...kept } = prev;
       session = { ...kept, mode: 'adopt', launched_at: now(), seen_at: now() };
       // a kept session is told what this run is for (its card came back to it, with what happened since)
       tx(board, (db) => setRunSession(db, runId, { ...session, ...meta }));
@@ -1252,6 +1363,15 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
         }
       }
     } else if (prev.resumable !== false) {
+      const authorization = view(board, db => currentRun(db,task.id)?.metadata?.supercode?.restart_authorized);
+      const released = view(board,db=>{
+        const last = db.prepare("SELECT id,kind FROM task_events WHERE task_id=? AND kind IN ('dispatch_held','dispatch_released','restart_authorization_consumed') ORDER BY id DESC LIMIT 1").get(task.id);
+        return last?.kind === 'dispatch_released';
+      });
+      // Only a session whose run ended in a monitored incident waits for its manager or creator; one a workflow
+      // transition closed (a reviewer after its verdict, an implementer whose card came back) is the slot's
+      // deliberate handoff, resumed for the slot's next run like any other
+      if (monitorsRuns(workflowFor(board.root)) && prev.monitor_held && !authorization && !released) throw new Error(`session ${prev.session_id} is stopped by incident ${prev.incident ?? 'unknown'}; only its manager or creator may restart it with workflow start`);
       // a resumed session is told what this run is for, as a kept one is: the run's own prompt (a reviewer resumed for
       // its next round gets that round's prompt, its arc's context with it), not only that it was resumed
       const told = input ? `The board resumed this session for this run of card ${task.id}.\n\n${input}` : `The board resumed this session after it was lost; you are still on card ${task.id}: ${task.title}. Carry on.`;
@@ -1304,7 +1424,7 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
 
 /** A machine reading, not a missing catalog entry, establishes whether a pane is alive. */
 function panePresent(machine, pane) {
-  const r = scOn(machine, ['teams', 'panes', 'ls'], { timeout: 60_000 });
+  const r = doorOn(machine, 'harness.v1.panes.list',{}, { timeout: 60_000 });
   const panes = r.code === 0 ? json(r.stdout.trim(), null) : null;
   if (!Array.isArray(panes)) throw unavailable(`cannot establish pane ${pane} liveness on ${machine}: ${(r.stderr || r.stdout).trim().slice(-300)}`);
   return panes.some((p) => p.pane === pane && !p.dead);
@@ -1319,6 +1439,7 @@ function paneSurvives(machine, pane) {
 /** Hermes's own worker argv and task environment, run on this machine; watched by its pid. */
 function launchHeadless(board, task, runId, lane, settings, { prompt = null, skills: runSkills = [], meta = {} } = {}) {
   const workspace = resolveLocalWorkspace(board, task);
+  if(meta.agent_profile_intent)meta.agent_profile_intent.worker={...meta.agent_profile_intent.worker,harness:lane.harness,model:task.model_override??lane.model??null,cwd:workspace};
   tx(board, (db) => db.prepare('UPDATE tasks SET workspace_path=?,branch_name=COALESCE(branch_name,?) WHERE id=?').run(workspace, task.workspace_kind === 'worktree' ? `wt/${task.id}` : null, task.id));
   // the card's own skills and the ones its status's run names (a reviewer's, for one)
   const skills = [...new Set([...task.skills, ...runSkills])];
@@ -1337,7 +1458,7 @@ function launchHeadless(board, task, runId, lane, settings, { prompt = null, ski
     env: {
       SUPERCODE_BOARD_EXIT_FILE: exitFile,
       ...(task.goal_mode ? { HERMES_KANBAN_GOAL_MODE: '1', ...(task.goal_max_turns ? { HERMES_KANBAN_GOAL_MAX_TURNS: String(task.goal_max_turns) } : {}) } : {}),
-      ...process.env, HERMES_HOME: lane.dir, HERMES_PROFILE: lane.name, HERMES_KANBAN_TASK: task.id, HERMES_KANBAN_WORKSPACE: workspace,
+      ...process.env, ...meta.agent_env, HERMES_HOME: meta.agent_env?.HERMES_HOME??lane.dir, HERMES_PROFILE: lane.name, HERMES_KANBAN_TASK: task.id, HERMES_KANBAN_WORKSPACE: workspace,
       HERMES_KANBAN_RUN_ID: String(runId), HERMES_KANBAN_DB: board.path, HERMES_KANBAN_BOARD: board.slug, HERMES_SESSION_SOURCE: 'kanban',
       HERMES_KANBAN_CLAIM_LOCK: claimer(), ...(prompt ? { SUPERCODE_BOARD_PROMPT: prompt } : {}), ...(task.tenant ? { HERMES_TENANT: task.tenant } : {}),
       ...(task.branch_name ? { HERMES_KANBAN_BRANCH: task.branch_name } : {}),
@@ -1396,14 +1517,14 @@ export function requestAdoption(board, id, who, { workspace = null, assignee = n
 }
 
 /** Adoptions the manager requested and no tick has answered yet, completed from this tick's fleet reading. */
-export function completeAdoptions(board, fleet, settings, report) {
+export function completeAdoptions(board, fleet, settings, report, lanes = null) {
   const pending = view(board, db => db.prepare(`SELECT e.task_id, e.payload FROM task_events e WHERE e.kind = 'dispatch_held'
     AND json_extract(e.payload, '$.reason') = 'adoption requested'
     AND e.id = (SELECT MAX(id) FROM task_events l WHERE l.task_id = e.task_id AND l.kind IN ('dispatch_held','dispatch_released','session_adopted','adoption_failed'))`).all());
   for (const row of pending) {
     const asked = json(row.payload, {}) ?? {};
     try {
-      const got = adoptSession(board, row.task_id, asked.session, { workspace: asked.workspace ?? null, assignee: asked.assignee ?? null, role: asked.role ?? null, ttl: settings.ttl, fleet: fleet?.ok ? fleet : null });
+      const got = adoptSession(board, row.task_id, asked.session, { workspace: asked.workspace ?? null, assignee: asked.assignee ?? null, role: asked.role ?? null, ttl: settings.ttl, fleet: fleet?.ok ? fleet : null , lanes});
       (report.adopted ??= []).push([row.task_id, got.address]);
     } catch (error) {
       const message = String(error.message).slice(-400);
@@ -1413,7 +1534,7 @@ export function completeAdoptions(board, fleet, settings, report) {
   }
 }
 
-function adoptSession(board, id, who, { workspace = null, ttl, assignee = null, role = null, fleet = null } = {}) {
+function adoptSession(board, id, who, { workspace = null, ttl, assignee = null, role = null, fleet = null, lanes = null } = {}) {
   fleet ??= observeFleet();
   if (!fleet.ok) throw new Error(`supercode could not read the fleet: ${fleet.error}`);
   const found = fleet.sessions.find((s) => s.address === who || s.address.endsWith(`:${who}`) || s.name === who);
@@ -1433,10 +1554,21 @@ function adoptSession(board, id, who, { workspace = null, ttl, assignee = null,
     dir = nativeSessions(host, harness).find((x) => x.locator?.session_id === sessionId)?.cwd ?? null;
   }
   if (!dir && found.pane) {
-    const r = sc(['teams', 'panes', 'ls', '--machine', host], { timeout: 60_000 });
+    const r = runtimeDoor(normalMachine(host)===localMachine()?null:host,'harness.v1.panes.list',{}, { timeout: 60_000 });
     dir = (json(r.stdout.trim(), []) ?? []).find((p) => p.pane === found.pane)?.cwd ?? null;
   }
-  return tx(board, (db) => {
+  // Rule 2: a session working a card role is that role's agent, however it started; adopted, it joins the agent as a
+  // launch does, and its recorded profile is compared with the role's intent (rule 4).
+  const entry0 = workflowFor(board.root), card0 = view(board, (db) => getTask(db, id));
+  const spec0 = view(board, (db) => runSpec(entry0, entry0.workflow.verbs?.adopt?.[0]?.target ?? 'running', card0));
+  const laneName = view(board, (db) => evaluate(entry0.workflow.roles?.[spec0?.role] ?? 'card.assignee', scopeOf(db, board, card0, { params: entry0.params }))) ?? assignee ?? card0?.assignee;
+  const lane = laneName ? lanes?.[laneName] : null, context = process.env.SUPERCODE_CONTEXT, team = agentScope(context);
+  let agent = null;
+  if (lane && !team.offline) {
+    try { agent = ensureCardAgent({ root: board.root, org: team.org, server: team.server, profiles: entry0.profiles, profile: lane.name, card: id, role: spec0?.role ?? 'implementer', sponsor: card0?.sponsor ?? null, machine: normalMachine(host) === localMachine() ? null : host, context }); }
+    catch (error) { if (!teamsUnavailable(error)) throw error; }
+  }
+  const adopted = tx(board, (db) => {
     const task = getTask(db, id);
     if (!task) throw new Error(`no card ${id}`);
     if ((task.current_run_id ?? null) !== (beforeRun?.id ?? null)) throw new Error(`${id} changed runs during adoption; retry against its current run`);
@@ -1459,16 +1591,68 @@ function adoptSession(board, id, who, { workspace = null, ttl, assignee = null,
       if (implementer?.session_id === sessionId) throw new Error('a reviewer must be independent of the implementer session');
     }
     event(db, id, 'dispatch_released', { reason: 'verified adoption', session: found.address });
-    if (!beforeRun) fire(db, board, entry, id, entry.workflow.run ? entry.workflow.dispatch.start : 'adopt', { roles: [entry.workflow.run ? 'platform' : 'manager'], payload: { lock: claimer() } });
+    // the manager's adoption is the workflow's own `adopt` verb where it declares one, sent as the manager; else its
+    // dispatch start, which the platform sends for a verified adoption
+    if (!beforeRun) { const verb = entry.workflow.verbs?.adopt || !entry.workflow.run ? 'adopt' : entry.workflow.dispatch.start;
+      fire(db, board, entry, id, verb, { roles: [verb === 'adopt' ? 'manager' : 'platform'], payload: { lock: claimer() } }); }
     const runId = getTask(db, id).current_run_id;
     if (!runId) throw new Error(`${id} waits on parents that are not done`);
-    const session = { surface: found.pane ? 'pane' : 'native', session_id: sessionId, harness, machine: host, pane: found.pane ?? null, address: found.address, mode: 'adopt', launched_at: now(), seen_at: now() };
+    const session = { surface: found.pane ? 'pane' : 'native', session_id: sessionId, harness, machine: host, pane: found.pane ?? null, address: found.address, mode: 'adopt', launched_at: now(), seen_at: now(),
+      ...(agent ? { agent_id: agent.identity.id, agent_org: team.org, agent_context: context ?? null,
+        agent_profile_intent: { ...structuredClone(agent.intended.resolved), worker: { ...agent.intended.resolved?.worker, harness: lane.harness, model: lane.model ?? null, cwd: dir ?? task.workspace_path ?? null } } } : {}) };
     setRunSession(db, runId, { ...(currentRun(db, id)?.metadata?.supercode ?? {}), ...session, slot: currentRun(db, id)?.metadata?.supercode?.slot ?? beforeSession?.slot ?? expected?.session ?? 'worker', close_requested: null, closed_at: null, close_confirmed_at: null, close_error: null, missing_since: null });
     event(db, id, 'session_adopted', { session_id: sessionId, machine: host, pane: session.pane, address: found.address, mode: 'adopt', role: currentRun(db, id)?.metadata?.supercode?.role }, runId);
     subscribeIn(db, id, found.address, 'worker');
     for (const p of db.prepare('SELECT parent_id FROM task_links WHERE child_id = ?').all(id)) subscribeIn(db, p.parent_id, found.address, 'dependency');
-    return { ...session, workspace: dir };
+    return { ...session, run: runId, workspace: dir };
   });
+  if (agent) recordAgentRun(board.root, team.org, agent.identity.id, { session: `${harness}:${sessionId}`, machine: host, run: adopted.run });
+  return adopted;
+}
+
+/** A manager/creator's manual native resume rebinds its existing run; this opens no process. */
+function reconnectContinuedSessions(board, fleet, entry, report) {
+  if (!monitorsRuns(entry) || !fleet.ok) return;
+  const rows = view(board, db => db.prepare(`SELECT r.* FROM task_runs r JOIN tasks t ON t.id=r.task_id
+    WHERE t.current_run_id IS NULL AND t.status NOT IN ('done','archived') AND r.id=(SELECT MAX(id) FROM task_runs WHERE task_id=t.id)
+    AND r.ended_at IS NOT NULL`).all());
+  const panes = new Map();
+  for (const row of rows) {
+    const saved = json(row.metadata,{})?.supercode;
+    if (!saved?.session_id || saved.forgotten || saved.close_transferred_to) continue;
+    if (!saved.monitor_held && !['crashed','closed','reclaimed','failed'].includes(row.outcome)) continue;
+    const live = fleet.sessions?.find(s => s.address === addressOf(saved) && s.state === 'running' && s.pane);
+    if (!live) continue;
+    if (!panes.has(saved.machine)) {
+      const answer = doorOn(saved.machine,'harness.v1.panes.list',{}, {timeout:60000});
+      const list = answer.code === 0 ? json(answer.stdout,null) : null;
+      panes.set(saved.machine,Array.isArray(list) ? new Set(list.filter(p=>!p.dead).map(p=>p.pane)) : null);
+    }
+    const pane = live.pane;
+    if (!pane || !panes.get(saved.machine)?.has(pane)) continue;
+    // A surviving timed-out process is not a manual restart. It needs a new pane.
+    if (pane === saved.pane && !saved.closed_at && !['crashed','closed','reclaimed'].includes(row.outcome)) continue;
+    tx(board, db => {
+      const task = getTask(db,row.task_id), scope = scopeOf(db,board,task,{params:entry.params});
+      const automaticPause = scope.card.paused?.reason?.startsWith('its session ended cleanly (');
+      if (task.current_run_id || (scope.card.paused && !automaticPause) || scope.card.blocked_by.length || scope.card.archived || statusOf(db,task) !== saved.status) return;
+      if (automaticPause) db.prepare('UPDATE supercode_cards SET paused=NULL WHERE task_id=?').run(row.task_id);
+      const session = { ...saved,pane,mode:'manual-continuation',state:entry.workflow.run?.initial ?? 'active',monitor_held:false,
+        prior_intervals:[...(saved.prior_intervals??[]),{ended_at:row.ended_at,outcome:row.outcome,error:row.error}],
+        launch_pending:false,launch_deferred:false,close_requested:null,closed_at:null,close_confirmed_at:null,close_error:null,missing_since:null,seen_at:now(),launch_key:null,
+        stopped_seconds:Number(saved.stopped_seconds??0) + Math.max(0,now()-row.ended_at) };
+      // Preserve the ended interval as evidence before reopening supervision on the same run.
+      event(db,row.task_id,'session_continued',{session_id:saved.session_id,from_pane:saved.pane,pane,prior_outcome:row.outcome,prior_ended_at:row.ended_at,incident:saved.incident??null},row.id);
+      db.prepare("UPDATE task_runs SET ended_at=NULL,status='running',outcome=NULL,error=NULL,metadata=?,claim_lock=?,claim_expires=? WHERE id=?")
+        .run(JSON.stringify({...json(row.metadata,{}),supercode:session}),claimer(),now()+900,row.id);
+      db.prepare('UPDATE tasks SET current_run_id=?,claim_lock=?,claim_expires=? WHERE id=?').run(row.id,claimer(),now()+900,row.task_id);
+      projectStatus(db,board,entry,row.task_id);
+      event(db,row.task_id,'dispatch_released',{reason:'verified manual continuation',session:addressOf(session),incident:saved.incident??null});
+      subscribeIn(db,row.task_id,addressOf(session),'worker');
+      for (const sub of db.prepare('SELECT task_id FROM supercode_cards WHERE subtask_of=?').all(row.task_id)) subscribeIn(db,sub.task_id,addressOf(session),'worker');
+      (report.continued ??= []).push([row.task_id,addressOf(session),pane]);
+    });
+  }
 }
 
 // ------------------------------------------------------------------ notify
@@ -1599,12 +1783,6 @@ async function notify(board, fleet, report, entry) {
     // a worker whose run has ended is not woken by a notice (a second session would start working the card beside
     // the one the next run gets): the notice is filed in its mailbox, read when it next works
     const working = role !== 'worker' || view(board, (db) => addressOf(currentRun(db, sub.task_id)?.metadata?.supercode) === sub.chat_id);
-    // An idle Claude session cannot hold a notice in its mailbox (it starts a turn for every message it is given), so
-    // a notice that must not wake it waits, unsent, for the session's next work.
-    if (!working && fleet.ok && fleet.sessions.some((s) => s.address === sub.chat_id && s.harness === 'claude-code' && s.status === 'idle')) {
-      report.notices_waiting = (report.notices_waiting ?? 0) + 1;
-      return;
-    }
     let cursor = Number(sub.last_event_id);
     let failed = null;
     try {
@@ -1623,7 +1801,7 @@ async function notify(board, fleet, report, entry) {
         } else text = noticeOf(entry, role, ev.kind, task, p);
         if (text) {
           const body = ['worker', 'dependency'].includes(role) ? identifyNotice(ev, text) : text;
-          const receipt = await send(board, from, board.label, sub.chat_id, body, `board-${sub.task_id}-${ev.id}-${sub.chat_id.slice(-12)}`, { queue: !working || (!entry.workflow.run && sub.delivery_mode === 'notify'), subject: `${ev.kind.replaceAll('_', ' ')} · run ${ev.run_id ?? 'none'} · event ${ev.id} · ${task?.title || sub.task_id}` });
+          const receipt = await send(board, from, board.label, sub.chat_id, body, `board-${sub.task_id}-${ev.id}-${sub.chat_id.slice(-12)}`, { queue: String(sub.chat_id).includes(':claude-code:') ? false : !working || (!entry.workflow.run && sub.delivery_mode === 'notify'), subject: `${ev.kind.replaceAll('_', ' ')} · run ${ev.run_id ?? 'none'} · event ${ev.id} · ${task?.title || sub.task_id}` });
           // A notice the recipient's mailbox took is filed: the machine delivers it at the session's next turn, so the
           // board does not send it again.
           if (!receipt.delivered && !receipt.queued) throw new Error(receipt.reason ?? 'notice was not filed');
@@ -1873,6 +2051,7 @@ const CORRUPT = /malformed|not a database|corrupt|disk image/i;
 
 /** What a tick would start on each board of the home, planned through the workflow's `dispatch`, writing nothing. */
 export async function plan({ root, lanes, settings, slugs = null, params = {} }) {
+  eventFleetRoot = root;
   const loaded = await loadWorkflow(root, { fresh: true });
   const entry = { ...loaded, params: { ...loaded.params, ...params } };
   const fleet = Object.values(lanes).some((l) => l.surface === 'pane') ? observeFleet() : { ok: false, alive: new Set(), online: new Set(), sessions: [], error: 'no pane lanes' };
@@ -1901,8 +2080,8 @@ export async function plan({ root, lanes, settings, slugs = null, params = {} })
 function noCodeReviewDue(board, id) {
   return view(board, (db) => {
     if (!db.prepare('SELECT 1 FROM supercode_cards WHERE subtask_of = ? LIMIT 1').get(id)) return false;
-    const last = db.prepare("SELECT kind FROM task_events WHERE task_id = ? AND kind IN ('review_requested', 'changes_requested', 'review_pass') ORDER BY id DESC LIMIT 1").get(id);
-    return !last || last.kind === 'changes_requested';
+    const last = db.prepare("SELECT kind FROM task_events WHERE task_id = ? AND kind IN ('review_requested', 'changes_requested', 'review_pass','review_voided') ORDER BY id DESC LIMIT 1").get(id);
+    return !last || ['changes_requested','review_voided'].includes(last.kind);
   });
 }
 
@@ -1978,6 +2157,7 @@ function capMax(cap, group, entry, lanes) {
  * version-checked card claims; no dispatcher file lock. Answers one report per board.
  */
 export async function tick({ root, lanes, settings, only = null, slugs = null, dispatch = true, params = {}, deploymentReceipt = false }) {
+  eventFleetRoot = root;
   // a verb's flags (dispatch --max, --failure-limit) are params of this tick, read by the workflow as its own
   const deployment = deploymentReceipt ? workflowRevision(root) : null;
   const loaded = await loadWorkflow(root, { fresh: true });
@@ -2008,16 +2188,14 @@ export async function tick({ root, lanes, settings, only = null, slugs = null, d
       // where the tick's time goes, phase by phase (ms), printed by `serve --verbose` and in `--json`
       let mark = Date.now();
       const phase = (name) => { const t = Date.now(); report.ms[name] = t - mark; mark = t; };
-      if (!fleet.machineEvents?.subscriptions?.includes(boardAddress(board.label))) {
-        const subscription = sc(['teams','machines','subscribe',boardAddress(board.label),'--json']);
-        if (subscription.code !== 0) report.failed.push(['machine_events',(subscription.stderr || subscription.stdout).trim().slice(-200)]);
-      }
+
       readMailbox(board, boardAddress(board.label), report); phase('mailbox');
       await refreshRelationAnswers(board); phase('answers');
       const effects = [];
-      completeAdoptions(board, fleet, settings, report); reconcileLaunches(board, fleet, report, entry, effects, settings, lanes); supervise(board, fleet, settings, report, entry, effects); await runEffects(board, effects.splice(0), { retryNotices: true }); closeRequested(board, report); phase('supervise');
+      completeAdoptions(board, fleet, settings, report, lanes); reconnectContinuedSessions(board, fleet, entry, report); reconcileLaunches(board, fleet, report, entry, effects, settings, lanes); supervise(board, fleet, settings, report, entry, effects); await runEffects(board, effects.splice(0), { retryNotices: true }); closeRequested(board, report); phase('supervise');
       report.unsettled = [];
       report.promoted = recomputeReady(board, effects, report.unsettled);
+      tx(board,db=>auditEndedRuns(db,board,entry));
       if (dispatch) await activatePullRequestReviews(board, entry, report, effects, { only });
       await sendBoardMessages(board, report);
       if (dispatch) startCards(board, fleet, lanes, settings, report, entry, effects, { only, held });